From 84e6a6e40ffc8e7e42279c6932bd1b9b7f6e24d9 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 5 Feb 2024 11:51:11 -0500 Subject: [PATCH] Last-minute updates for release notes. Security: CVE-2024-0985 (not CVE-2023-5869 as claimed in prior commit msg) --- doc/src/sgml/release-12.sgml | 44 ++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/doc/src/sgml/release-12.sgml b/doc/src/sgml/release-12.sgml index 02cee2e653..6ca12bc88a 100644 --- a/doc/src/sgml/release-12.sgml +++ b/doc/src/sgml/release-12.sgml @@ -47,6 +47,50 @@ + + Tighten security restrictions within REFRESH MATERIALIZED + VIEW CONCURRENTLY (Heikki Linnakangas) + + + + One step of a concurrent refresh command was run under weak security + restrictions. If a materialized view's owner could persuade a + superuser or other high-privileged user to perform a concurrent + refresh on that view, the view's owner could control code executed + with the privileges of the user running REFRESH. + Fix things so that all user-determined code is run as the view's + owner, as expected. + + + + The only known exploit for this error does not work + in PostgreSQL 16.0 and later, so it may + be that v16 is not vulnerable in practice. + + + + The PostgreSQL Project thanks Pedro + Gallegos for reporting this problem. + (CVE-2024-0985) + + + + +